Description
Trivy uses only Version field to detect root.io packages:
|
func hasPackageWithPattern(pkgs []ftypes.Package, pattern *regexp.Regexp) bool { |
|
for _, pkg := range pkgs { |
|
if pattern.MatchString(utils.FormatVersion(pkg)) { |
|
return true |
|
} |
|
} |
|
return false |
|
} |
But
dpkg packages also contain
Release and
Epoch fields.
root.io suffix is part of
Release field, That is why Trivy doesn't detect
root.io debian/ubuntu images.
Description
Trivy uses only
Versionfield to detectroot.iopackages:trivy/pkg/detector/ospkg/rootio/provider.go
Lines 39 to 46 in d898543
But
dpkgpackages also containReleaseandEpochfields.root.iosuffix is part ofReleasefield, That is why Trivy doesn't detectroot.iodebian/ubuntu images.